# CVE-2026-53492: containerd CDI annotation smuggling during CRI checkpoint restore

Source: https://junglewise.ai/threats/cve-2026-53492-containerd-cdi-annotation-smuggling-during-cri-checkpoint-restore  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-53492 · Severity: high · CVSS 4 · Published 2026-07-01

containerd is a widely used tool for managing and running software containers in cloud environments like Kubernetes. A security flaw allows users with basic permissions to bypass safety checks when restoring a container from a saved state (checkpoint). This could allow an attacker to gain unauthorized access to sensitive hardware devices or host files, potentially compromising the security of the entire server.

Technologies: [Containerd](https://junglewise.ai/threats/technologies/containerd), [github.com/containerd/containerd (Go)](https://junglewise.ai/threats/technologies/github-com-containerd-containerd), [github.com/containerd/containerd/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-containerd-containerd-v2). Vendors: [Containerd](https://junglewise.ai/threats/vendors/containerd), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-53492 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53492 being exploited in the wild.

**How severe is CVE-2026-53492?** High severity, with a CVSS score of 4, published 1 July 2026.

**Which products and versions are affected?** Containerd >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2; github.com/containerd/containerd (Go) SEMVER:introduced=0; github.com/containerd/containerd/v2 (Go) SEMVER:introduced=2.1.0,fixed=2.1.9, SEMVER:introduced=2.1.0,fixed=2.1.9,introduced=2.2.0,fixed=2.2.5,introduced=2.3.0,fixed=2.3.2.

**Is there a fix for CVE-2026-53492?** Yes. github.com/containerd/containerd/v2 (Go): upgrade to 2.1.9, 2.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53492 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53492?** Check whether you run Containerd, github.com/containerd/containerd (Go) or github.com/containerd/containerd/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/containerd/containerd/v2 (Go): upgrade to 2.1.9, 2.3.2 or later

  ```sh
  go get github.com/containerd/containerd/v2@v2.3.2
  ```


## Technical details

The vulnerability exists in containerd's Container Runtime Interface (CRI) implementation during the restoration of containers from checkpoints. The root cause is that containerd preserves CDI-related annotations from untrusted checkpoint archive metadata instead of strictly adhering to the pod's original create-time specification. An attacker with pod creation permissions can use this to perform 'annotation smuggling,' injecting arbitrary CDI edits such as unauthorized device nodes and host mounts. This bypasses standard Kubernetes resource allocation and device plugin enforcement. Exploitation requires the node to have CDI enabled and contain matching host CDI specifications; it is fixed in versions 2.3.2, 2.2.5, and 2.1.9.

## Affected products

- containerd containerd >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2

## Identifiers

- CVE-2026-53492
- GHSA-33vj-92qq-66hc
- GO-2026-5064

## Timeline

- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-07-01: disclosed: NVD publication date

## References

- [https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc](https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc)

## Related threats

- [containerd layer unpack denial of service via opaque whiteouts](https://junglewise.ai/threats/cve-2026-95838-containerd-unpack-dos-via-repeated-opaque-whiteouts)
- [containerd CRI plugin checkpoint restore privilege bypass](https://junglewise.ai/threats/cve-2026-95837-containerd-cri-plugin-checkpoint-restore-bypasses-destination)
- [Containerd image-pull denial of service via OCI index graph amplification](https://junglewise.ai/threats/cve-2026-53493-containerd-image-pull-denial-of-service-via-oci-index-graph)
- [containerd CRI ExecSync goroutine leak denial of service](https://junglewise.ai/threats/cve-2026-53495-containerd-cri-execsync-goroutine-leak-denial-of-service)
- [containerd CRI security context bypass in checkpoint restore](https://junglewise.ai/threats/containerd-cri-security-context-bypass-in-checkpoint-restore-d7cf36e0)